Linux kernel tegra241-cmdqv: use-after-free issuing CMD_SYNC on a freed command queue at teardown

Impact

arm_smmu_impl_remove() is registered as a devres action before arm_smmu_init_queues() allocates smmu->cmdq.q.base, so on any devres unwind the command queue is freed first and the impl remove path then runs tegra241_cmdqv_remove_vintf(), whose VINTF deinit issues a CMD_SYNC against that freed memory. The reported trace is a kernel paging fault in arm_smmu_cmdq_issue_cmdlist() reached through devres_release_all(). Two paths get there: a failed SMMU probe (observed when the VCMDQ fails to enable, so the impl reset fails and probe aborts) and a live driver unbind. tegra241_cmdqv_remove_vintf() is also on the iommufd viommu destroy path, so it is reachable from normal passthrough teardown rather than only from driver surgery. This is the SMMU on NVIDIA Grace silicon - the IOMMU sitting between assigned GPUs and NICs and host memory on GH200/GB200-class nodes, where a boot-time probe failure now means a crashed node instead of a degraded one.

Who can reach it

Local, and mostly not attacker-driven: a failing SMMU probe at boot, a driver unbind, or an iommufd viommu destroy on a Grace-based host. Reaching the viommu destroy path requires holding an iommufd descriptor for a passthrough device.

What to do

Apply the stable kernel fix on Grace-based nodes; it drops the VINTF deinit from the remove path and quiesces the VINTFs earlier via a new device_disable() impl op run from arm_smmu_disable_action() while the CMDQ is still up, plus a quiesce on the iommufd viommu destroy path. Kernel change on the boot path, so each affected node needs a drain and reboot onto the patched kernel; livepatch is not a realistic option for a probe-time fix. Non-Grace hardware does not build or run this driver and needs no action.

References

Related entries

• Linux kernel virtio-crypto: unbounded device-reported result length over-reads guest kernel heapCVE-2026-80836 · Linux kernel virtio-crypto akcipher completion path (virtio_crypto_dataq_akcipher_callback)Unscored
• Linux KVM SEV: sub-page command buffer on SNP hosts triggers RMP faults and host panicCVE-2026-80853 · Linux KVM SEV (temporary buffer for {DE,EN}CRYPT ops on SNP-enabled hosts)Unscored
• Linux kernel FUSE: interrupted DAX truncate on O_TRUNC open leaks the invalidate lock, wedging the fileCVE-2026-80855 · Linux kernel FUSE (DAX truncate path in fuse_open)Unscored
• Linux kernel FUSE: setattr writeback failure leaks the invalidate lock on a DAX truncateCVE-2026-80856 · Linux kernel FUSE (DAX truncate path in fuse_do_setattr)Unscored
• Linux kernel FUSE: abort_on_kill returns without waiting for FR_FINISHED, freeing an in-flight requestCVE-2026-80857 · Linux kernel FUSE request handling (request_wait_answer abort_on_kill path)Unscored
• Linux kernel FUSE: io_uring queues published without release ordering can be read half-initializedCVE-2026-80858 · Linux kernel FUSE (io_uring queue publication ordering)Unscored